I've been working on my open source integration-platform-as-a-service (iPaaS) auth proxy. It provides an embeddable integration marketplace where users can connect 3rd party apps, and it provides a proxy endpoint to the host application to send authenticated outbound requests. That way token refresh, audit, etc stay with this system and frees the host application/agent/whatever free to just focus on the business logic.
I really like the approach you've taken of providing an egress proxy. That let's you do a lot of things that layer around providing gaurdrails and auditing. I've been taking a similar approach on an open source embedded iPaaS project I've been working on where it primarily offers an authenticating egress proxy to whatever business logic needs it (agent, sync engine, etc).
I work on a team that has members distributed across two locations. We use the policy described above, but there is a flip side to this problem. Most of our developers are one location with a 1/6 minority in another. The larger group of developers loses the advantages of face-to-face communication for meetings in favor of equal footing for everyone. Is that a net improvement on quality of communication? I don't know, but I'd rather meet with my colleagues in adjacent cubes face-to-face rather than over the phone the way we do now.
The best part of that page was the ad for the Google Nexus One at the bottom that Google chose to show me. But I don't care, because Google does a pretty good job.
https://github.com/rmorlok/authproxy